Changeset 088b070

Timestamp:

2015-05-08T02:02:14Z (10 years ago)

Author:

dequis <dx@…>

Branches:

master

Children:

5014380

Parents:

5535a47

Message:

msn: fix use-after-free when the server sends OUT

Also fix a leak in msn_ns_callback while i'm at it.

Also fix a potential null deref when req->reply_body is null and
BITLBEE_DEBUG is enabled, but i don't even know if this one can happen.

Location:

protocols/msn

Files:

• gw.c (modified) (2 diffs)
• ns.c (modified) (2 diffs)

protocols/msn/gw.c

@@ -87 +87 @@
         gw->polling = FALSE;
 
+        if (req->status_code != 200 || !req->reply_body) {
+                gw->callback(gw->md, -1, B_EV_IO_READ);
+                return;
+        }
+
         if (getenv("BITLBEE_DEBUG")) {
                 fprintf(stderr, "\n\x1b[90mHTTP:%s\n", req->reply_body);
                 fprintf(stderr, "\n\x1b[97m\n");
-        }
-
-        if (req->status_code != 200) {
-                gw->callback(gw->md, -1, B_EV_IO_READ);
-                return;
         }
 
@@ -113 +113 @@
         if (req->body_size) {
                 g_byte_array_append(gw->in, (const guint8 *) req->reply_body, req->body_size);
-                gw->callback(gw->md, -1, B_EV_IO_READ);
+
+                if (!gw->callback(gw->md, -1, B_EV_IO_READ)) {
+                        return;
+                }
         }
 

protocols/msn/ns.c

@@ -181 +181 @@
                 imcb_error(ic, "Error while reading from server");
                 imc_logout(ic, TRUE);
+                g_free(bytes);
                 return FALSE;
         }
@@ -188 +189 @@
         g_free(bytes);
 
-        /* Ignore ret == 0, it's already disconnected then. */
-        msn_handler(md);
-
-        return TRUE;
-        
+        return msn_handler(md);
 }